Inside Privacy - Updates on Developments in Global Privacy & Data Security

On Tuesday, Senators Carl Levin (D-MI), John McCain (R-AZ), Jay Rockefeller (D-WV), and Tom Coburn (R-OK) introduced the “Deter Cyber Theft Act.”

The Act would require the Director of National Intelligence (“DNI”) to provide relevant congressional committees with an annual report on “foreign economic and industrial espionage in cyberspace.”  The report would require the DNI to identify “foreign countries that engage in economic or industrial espionage in cyberspace with respect to trade secrets or proprietary information owned by United States persons” and “priority foreign countries”—those countries that the DNI “determines engage in the most egregious economic or industrial espionage in cyberspace.”  The bill specifies that the DNI must identify foreign countries pursuant to the Act  if the foreign government “engages in economic or industrial espionage in cyberspace with respect to trade secrets or proprietary information owned by United States persons” or “facilitates, supports, fails to prosecute, or otherwise permits such espionage by” its citizens or residents or entities organized under its laws or subject to its jurisdiction.

Continue Reading

Yesterday, a bill that would reform the Electronic Communications Privacy Act of 1986 ("ECPA") was approved by the Senate Judiciary Committee on a voice vote. Under ECPA, as it currently stands, police need only a subpoena, issued without approval by a judge, to access private e-mails that have already been opened or that are more than 180 days old. Under the reform bill, which was sponsored by Committee Chairman Patrick Leahy (D-Vt.) and Senator Mike Lee (R-Utah), police would have to obtain a search warrant before requiring providers of electronics communications services to provide them access to e-mails and other private online content, including Facebook messages.

Privacy advocates, including public interest organizations and Internet businesses, have long urged Congress to update ECPA to bring it in line with the myriad technological changes that have taken place since its enactment nearly 30 years ago, as well as consumers' evolving expectations of privacy in their electronic communications. A statement by Computer & Communications Industry Association president and CEO Ed Black reflects that widespread position: "This is a long overdue step toward bringing our online privacy laws closer to both our existing Fourth Amendment protections and our reasonable expectations for privacy. . . . Most people don't realize that six-month-old emails have different levels of privacy protection than newer emails." The Internet Association, an organization of prominent Internet businesses including Facebook, Google, and eBay, called the Senate Judiciary Committee's passage of the ECPA reform bill "a significant step in safeguarding the privacy of users' electronically stored content." The passage of the bill through the Judiciary Committee on a voice vote bodes well for its chances of being passed by the full Senate.

By David N. Fagan and Kristen E. Eichensehr 

On March 28, our firm hosted an event, co-sponsored with The Chertoff Group, on Legal and Policy Developments in Cybersecurity.  The event featured keynote addresses by former Secretary of Homeland Security Michael Chertoff, now Senior Of Counsel with Covington and founder of The Chertoff Group, and Representative Mike Rogers (R-MI), Chairman of the House Permanent Select Committee on Intelligence (“HPSCI”) and principal sponsor of the Cyber Intelligence Sharing and Protection Act (“CISPA”), which passed the House last year and is expected to be re-introduced and voted upon in HPSCI soon. 

The program also included a panel discussion examining the scope of the cybersecurity threat confronting the government and private sector; how law, regulation, and policy may address the threat; and certain competing policy imperatives, including balancing security and economic considerations.  The panel included three partners at Covington -- David Fagan (who moderated), John Veroneau (international trade), and Robert Nichols (government contracting) -- along with Prescott Winter, Managing Director of the Chertoff Group; James Mulvenon of Defense Group, Inc.; and Scott Aaronson of the Edison Electric Institute. 

As Congress moves toward votes on cybersecurity legislation, we thought it would be timely to offer some reflections on the program and panel discussion.  In particular, while cybersecurity is a topic du jour in Washington and the press, the program sought to dig deeper than the headlines, unpack the complexity of cybersecurity, and explore how the interconnection of systems and the related threats impact various legal, policy, and business considerations.  The following are some observations from the event:

Continue Reading

By Emily Borgen & Steve Satterfield

Legislation was reintroduced in the Senate last week that would allow Internet users to opt out of certain forms of online tracking.  The bill [PDF] was previously introduced in 2011.

The “Do-Not-Track Online Act of 2013,” introduced on February 27 by Senators Rockefeller (D-W.Va.) and Blumenthal (D-Conn.), would require the Federal Trade Commission to create rules for the implementation of a mechanism that would enable an individual to “simply and easily indicate whether [the] individual prefers to have personal information collected by providers of online services” -- in other words, a "Do Not Track" mechanism.  The FTC rules, which would generally prohibit collecting information from users who have opted out of such collection, would be enforced by the FTC and state attorneys general.

The bill contains two exceptions that would permit entities to collect and use information collected online from users who have enabled the do not track mechanism.  First, entities would be permitted to collect information necessary to the “basic functionality and effectiveness” of a requested service, so long as the information is anonymized or deleted after the provision of the service.  Second, the bill would permit entities to request that users opt-in to collection and use of their information; in other words, entities would be permitted to collect information from users who opt in regardless of whether those users had enabled the Do Not Track mechanism.

The timing of the bill’s reintroduction is significant for at least two reasons.  First, this month marks one year since the release of the FTC’s report in which the FTC urged industry to create a do not track mechanism.  In statements made around the time of the report’s release, FTC commissioners suggested that the agency might support Do Not Track legislation if industry did not establish such a mechanism on its own.  Second, just last month, reports emerged that the principal effort at developing an industry-based Do Not Track mechanism -- the W3C’s Tracking Protection Working Group -- was beginning to make substantial progress in finalizing its specifications.  Additional progress by this group could affect further calls for legislation.

A bill reintroduced in the U.S. House of Representatives on Wednesday would prohibit employers and schools from requesting or demanding access to employees’ or students’ personal social-media accounts.

The bill, titled the “Social Networking Online Protection Act,” would bar employers from requesting or requiring that employees or job applicants provide the employer access to personal e-mail or social-networking accounts.  The bill also would bar employers from firing or otherwise retaliating against an employee or applicant for refusing or complaining about such a request. Violations would carry a civil penalty of up to $10,000, and the bill would authorize the Secretary of Labor to seek an injunction against practices that violate the law.

The bill would establish similar protections for students or applicants at colleges and K-12 schools receiving federal funds. 

Continue Reading

On Friday, Rep. Hank Johnson (D-Ga.) released a discussion draft of a bill for mobile privacy. Named the Application Privacy, Protection and Security Act of 2013 (“APPS Act”), the bill would obligate app developers to disclose to users the terms and conditions around the collection, use, storage, and sharing of user data. Additionally, the bill would require apps to allow users to opt out of the service and delete personal data collected by the app. The Federal Trade Commission would head enforcement and state attorneys general could bring suits against those who violate the regulations promulgated by the FTC.

 In drafting the bill, Johnson and his Web-based initiative, AppRights, held meetings with members of the Internet community, public-interest groups, app developers, and other industry stakeholders. AppRights stated: “Over the coming days, we will release helpful clarifications of the updated provisions of the APPS Act so that everyone is on the same page." It is not yet clear when the bill will be introduced to Congress as possible legislation.

Continue Reading

Yesterday, President Obama signed into law the “Video Privacy Protection Act Amendments Act of 2012,” a law that amends the VPPA’s notoriously vague consent provision.  As originally enacted, the VPPA allowed “video tape service providers” to disclose consumers’ “personally identifiable information” (including their video viewing histories) with a consumer’s consent only if that consent were “informed, written . . . [and] given at the time the disclosure [was] sought.”  Even in the brick-and-mortar world of 1988 (when the VPPA was passed), this consent provision was confusing.  What did it mean to provide consent “at the time the disclosure [was] sought”?  “Sought” by whom (the video tape service provider, the consumer or a third party)?  Could a consumer authorize a disclosure in advance of its occurrence? 

The application of the consent provision has become even more vexed over time, as video distribution has changed radically.  Some have argued that the VPPA is broad enough to govern the disclosure of video viewing activities online, and so online video service providers have grown increasingly interested in this once-obscure statute.  Late last year, Congress acted to help clarify the consent issue.

After the jump, we provide our final analysis of the amendments. 

Continue Reading

Continuing the flurry of activity around privacy legislation that we have seen over the past few weeks, the House today passed an amendment to the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710.  The bill would amend the VPPA by clarifying that a consumer may consent to the disclosure of her video viewing information “though an electronic means using the Internet” (e.g., by clicking a button or ticking a box) and that such consent can be provided in advance of a disclosure and continue for a set period of time or until the consumer withdraws her consent.   

The House passed a similar bill, H.R. 2471, in December of 2011.  As we’ve previously noted, Senator Leahy created a substitute amendment for H.R. 2471 that included amendments to the Electronic Communications Privacy Act, and several minor modifications to the VPPA portion.  The substitute amendment passed the Senate Judiciary Committee in late November.  The bill passed today, H.R. 6671, contains the same VPPA language as the Senate version, but does not include the ECPA amendments proposed by Sen. Leahy. 

H.R. 6671 will now head back to the Senate, where, The Hill reports, it could be considered in the coming weeks. 

Today, the Senate Judiciary Committee passed the much-discussed update to the Electronic Communications Privacy Act of 1986 and the Video Privacy Protection of 1988 ("VPPA").  The Committee adopted Senator Leahy's manager's amendment (which we discussed here), with a minor modification proposed by Senators Cornyn and Lee. 

Senator Feinstein also offered an amendment to the VPPA portion of the bill.  In its original form, the bill provided that a consumer could consent to the disclosure of her video viewing information to a third party "in advance for a set period of time or until consent is withdrawn by the consumer." Under Feinstein's amendment , which the Committee adopted, the "set period of time" for which a person may provide consent would be limited to one year.  Feinstein noted that her office had been in contact with Netflix about the amendment.    

Senator Leahy acknowledged that no further action would be taken on the bill in this Congress.  But he pledged to work with new House Judiciary Committee Chair Bob Goodlatte on ECPA and VPPA reform in the next Congress. 

On Thursday, the Senate Judiciary Committee reportedly will vote on Sen. Patrick Leahy’s bill that would amend the Electronic Communications Privacy Act (ECPA) and the Video Privacy Protection Act (VPPA).  The bill would amend the VPPA by clarifying that a consumer may consent to the disclosure of her video viewing information “though an electronic means using the Internet” (e.g., by clicking a button or ticking a box) and that such consent can be provided in advance of a disclosure and continue for a set period of time or until the consumer withdraws her consent.  The amendments to ECPA would, among other things, eliminate the archaic distinctions in the current statute between the legal protections for (1) communications held by “remote computing services” and those held by “electronic communications services” (“ECS”) and (2) for communications stored by an ECS for longer than 180 days and those held for shorter period of time.

Although reports emerged last week that, in response to concerns from law enforcement, Leahy had scaled back the bill’s protections for stored electronic communications, the manager’s amendment released yesterday by Leahy’s office shows only minor modifications to the bill he introduced earlier this year.  The modifications (which are summarized here) mainly concern the time within which the government must notify an individual that the government has obtained the individual’s communications from a third-party provider, when such notice is required by ECPA. 

These changes to the original bill are intended to address concerns raised by law enforcement that the amendments could impede investigations of criminal activity.  However, reports suggest that even the revised bill still may face law enforcement opposition.